Common Security Policy Management Mistakes and How to Avoid Them